Skip to main content

Security & permissions

The MCP server is designed to give AI assistants useful, bounded access to your Rewind data. A few things worth knowing before you share access.

API keys​

  • Keys are scoped to your organization, and only an Owner or Admin can create or revoke them in Settings → Security → API Tokens.
  • Revoking a key takes effect immediately — any client using it loses access at once.
  • Use a dedicated key for the MCP so you can revoke it independently of your other integrations.
  • Treat the key like a password: keep it in your client's config file or an environment variable, and never commit it to shared code or version control.

What the MCP can and can't do​

  • The MCP is read-first. The only write action is trigger_backup, which starts an on-demand backup — it pre-checks state first and never deletes or overwrites your data. It runs asynchronously; the assistant kicks it off and you poll for completion.
  • Restores are not available through the MCP server. A restore overwrites your data, so it must be performed by signing in to Rewind.

Consider a dedicated, revocable API key for MCP use.

See the full list of what's exposed under Tools.